---
slug: /features/secrets
description: "Safeguard your secrets"
---
import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';

# Secrets

Dagger supports the use of confidential information, such as passwords, API keys, SSH keys, access tokens and so on, in your pipelines. These "secrets" can be sourced from different secret providers and passed to Dagger Functions as arguments.

Dagger supports multiple secret providers. It can securely read secrets from the host environment, the host filesystem, the result of host command execution, and external secret managers [1Password](https://1password.com/) and [Vault](https://www.hashicorp.com/products/vault).

Dagger has built-in safeguards to ensure that secrets are used without exposing them in plaintext logs, writing them into the filesystem of containers you're building, or inserting them into the cache. This ensures that sensitive data does not leak - for example, in the event of a crash.

Here's an example of a pipeline that receives and uses a GitHub personal access token as a secret:

<Tabs groupId="language">
<TabItem value="Go">
```go file=./snippets/secrets/go/main.go
```
</TabItem>
<TabItem value="Python">
```python file=./snippets/secrets/python/main.py
```
</TabItem>
<TabItem value="TypeScript">
```typescript file=./snippets/secrets/typescript/index.ts
```
</TabItem>
<TabItem value="PHP">
```php file=./snippets/secrets/php/src/MyModule.php
```
</TabItem>
<TabItem value="Java">
```java file=./snippets/secrets/java/src/main/java/io/dagger/modules/mymodule/MyModule.java
```
</TabItem>
</Tabs>

The secret can be passed from the host environment via the `env` provider:

![Secret from environment](/img/current_docs/features/secrets-env.gif)

Secrets can also be passed from host files via the `file` provider (shown below) or from host command output via the `cmd` provider:

![Secret from file](/img/current_docs/features/secrets-file.gif)

Secrets can also be read from external secret managers, such as Vault (`vault`):

```shell
dagger call github-api --token=vault://credentials.github
```

...or 1Password (`op`):

```shell
dagger call github-api --token=op://infra/github/credential
```

![Secret from 1Password](/img/current_docs/features/secrets-1password.gif)

## Learn more

- [Use secrets as function arguments](../api/arguments.mdx#secret-arguments)
